What problem are you facing?

In my use-case, I have apps in many different namespaces and not only in the default namespace.
This provider does not properly support this feature (see argo doc here).

How could Crossplane help solve your problem?

Change the Observe call to use the Get endpoint and add an appNamespace field in the MR spec so that it can be provided in the Get call.

Note: I saw that you are not using the Get endpoint due to the permission denied issue, but from my testing, that issue only arises if the appNamespace is not provided and you're trying to get an app which is not in the default namespace.